The approach we are going with is having a url scheme like /partner/bigOrg/smallOrg, where /partner/bigOrg/ is the protected resource so that we can give BigOrg, the /partner/bigOrg/smallOrg urls for each of their small orgs (for SP initiated SSO). My hope was that the full URL gets picked up by the SP and put into relayState and then the browser redirects back to that full URL at the end of the flow. What I have noticed is the browser is redirected to /partner/bigOrg, which isn't really what I wanted, but there is a cookie named _shibstate_**** that has the URL I want in it. What is shibstate and is it different from relayState? I don't actually see relayState anywhere in the server variables.<br>
<br><div class="gmail_quote">On Mon, Jul 16, 2012 at 1:58 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5">On 7/16/12 1:53 PM, "Rob Whitener" <<a href="mailto:rob.whitener@audaxhealth.com">rob.whitener@audaxhealth.com</a>> wrote:<br>
><br>
>I am a little confused over the relayState parameter and specifically how<br>
>it gets set (or how I can get a value into relayState in my SP). We are<br>
>working with a partner who, for reasons we still can't fathom, insist on<br>
>using relayState as a method of<br>
> partitioning out the organzations their customers belong to (rather than<br>
>just putting it into an attribute). If I wan't a particular URL to be in<br>
>the relaystate, do I have to set up applicationOverrides to accomplish<br>
>that?<br>
<br>
</div></div>The only thing the SP allows relay state to be is a token that it will use<br>
to identify the URL to send the browser after login. That's absolutely it.<br>
Assuming you want to control that URL, you simply protect that URL with a<br>
requireSession property and access it, or you generate a redirect to a<br>
SessionInitiator (/Shibboleth.sso/Login) and set target to the URL you<br>
want.<br>
<br>
Or you can manufacture an IdP-initiated SSO scenario at the IdP and that<br>
will document how RelayState can get set to a URL.<br>
<br>
But in all cases, all you're doing is controlling the URL to end up at.<br>
You cannot separate it from that function.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>